CHEX: statically vetting Android apps for component hijacking vulnerabilities

By Long Lu, Zhichun Li, Zhenyu Wu, Wenke Lee, Guofei Jiang. Conference on Computer and Communications Security, 2012

690 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Information Systems, Signal Processing

View Paper: https://www.semanticscholar.org/paper/7216ec1cbc1d9241489c27d9b0001cdaef676480

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Information Systems

In Signal Processing

Citations in the corpus

Static analysis of android apps: A systematic literature review (2017, background): “WALA IR A3E [57], AAPL [61], AnDarwin [49], AndroidLeaks [80], AsDroid [95], Asynchronizer [144], CHEX [8], DNADroid [48], Hopper [79], ORBIT [154], Poeplau et al.”
Reliable Third-Party Library Detection in Android and its Security Applications (2016, background): “, [12, 45, 21, 2, 42, 13, 28, 25, 11]) by allowing them to attribute their results to the correct principals (app or library developers).”
*droid (2016, methodology): “…framework contains thousands of methods, most static analysis tools that need to analyze ﬂow through the framework use manually described models of the behavior described as stub functions [Gordon et al. 2015; Fritz et al. 2014; Wei et al. 2014; Kim et al. 2012; Feng et al. 2014; Lu et al. 2012].”
IccTA: Detecting Inter-Component Privacy Leaks in Android Apps (2015, background): “By dividing applications into components that can exchange data within a single application or even across several applications, Android encourages software reuse, and thus reduces developer burden.”
You Get Where You're Looking for: The Impact of Information Sources on Code Security (2016, neutral): “distracted or overwhelmed [1], [8], [9], [11], [14]–[18], [26], [29], [31], [33], [34], [36], [43], [44], [46].”
Evaluating Analysis Tools for Android Apps: Status Quo and Robustness Against Obfuscation (2016, background): “CHEX [28] X X DexLib, WALA, Stowaway Woodpecker [21] X X baksmali DroidChecker [10] X X X Java Decompiler (JD), ANTLR Epicc [33] X X X Dare, Soot (Spark, Heros) X”
Effective inter-component communication mapping in Android with Epicc: an essential step towards holistic security analysis (2013, background): “These vulnerabilities can lead to permission leakage [17, 19, 25].”
FlowDroid: precise context, flow, field, object-sensitive and lifecycle-aware taint analysis for Android apps (2014, methodology): “Past data-flow analysis approaches for Android [14, 15, 24, 40] handle the above challenges in an unsatisfactory manner using coarse-grained over- as well as under-approximations.”
Security Analysis of Emerging Smart Home Applications (2016, background): “We also contacted the developer of the Android app that had the OAuth client ID and secret present in bytecode.”
Vetting undesirable behaviors in android apps with permission use analysis (2013, methodology): “CHEX [41] and DroidChecker [19] were two tools that could detect such kind of capability leaks.”
MaMaDroid: Detecting Android Malware by Building Markov Chains of Behavioral Models (2016, methodology): “Other methods, such as CHEX [37], use data ﬂow analysis to automatically vet Android apps for vulnerabilities.”
Amandroid: A Precise and General Inter-component Data Flow Analysis Framework for Security Vetting of Android Apps (2014, methodology): “Existing off-the-shelf static analysis tools such as Soot [32] (used by FlowDroid [6, 17] and Epicc [25]) and Wala [16] (used by CHEX [23]) have not provided capability of calculating all objects’ points-to information in a both flow and context-sensitive way [4, 22].”
Android Security: A Survey of Issues, Malware Penetration, and Defenses (2015, methodology): “components using their definition and bytecode interaction to identify the vulnerabilities [8], [84], [85].”
Information Flow Analysis of Android Applications in DroidSafe (2015, background): “Standard issues that complicate the construction of such systems are the challenges of 1) scaling to large applications and 2) maintaining precision in the analysis such that it does not report too many ﬂows that do not actually exist in the application.”
PScout: analyzing the Android permission specification (2012, methodology): “CHEX [26] is a static analysis method for android applications to detect component hijacking vulnerabilities.”
ReCon: Revealing and Controlling PII Leaks in Mobile Network Traffic (2015, methodology): “Another approach is to perform static analysis ( e.g., using data ﬂow analysis or symbolic execution) to determine a priori whether an app will leak privacy information [12, 13, 19, 23, 25, 31, 37, 39, 46, 59, 61–63].”
A Multimodal Deep Learning Method for Android Malware Detection Using Various Features (2019, neutral): “CHEX [13], DroidChecker [14], AAPL [15], and”